Body
< !!! INTERNAL USE ONLY !!! >
Not for distribution directly to end user
Overview
This article is intended to refresh the user's memory on exact syntax and locations, for those who have worked with it before or just want a limited understanding.
Audience
ITS Staff
Process
Quick Facts
This document assumes the uses of "zones". Zones are sets of IP addresses to which particular firewall rules apply. Configuration of the firewall combines zones and rules.The default zone is applied if no other rule matches and this is recommended to be "drop".
Remember that a zone represents an area of the network. In order to become active, it has to be assigned source ip addresses or interface.
Problems have been encounter with syntax errors causing the state of the firewall to be unpredictable. Consider restarting the firewall, nftables, and even the system itself.
Firewall Operation
| Operation |
Command |
| Start |
systemctl start firewalld |
| Stop |
systemctl stop firewalld |
| Reload configuration |
firewall-cmd --reload
|
| List all zones with status |
firewall-cmd --list-all-zones |
| Status check |
systemctl status firewalld |
| Set default zone (drop is example) |
firewall-cmd --set-default drop |
File Locations
File locations pertain to Oracle Linux 8. Other distributions have an identical structure that can be searched for.
| Location |
Purpose |
| /etc/firewalld |
Overall firewalld configuration location |
| /etc/firewalld/zones |
Rules for each zone.
|
| /etc/firewalld/ipsets |
Used to define zones. |
Configuration
- Create a file in ipsets using the example IPSET file from below.
- Create a file in the zones using the example ZONE file from below.
- Reload the firewall configuration.
- List the zones to make sure its working.
Example Files
IPSET
<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:net">
<entry>10.20.12.174</entry>
<entry>10.20.133.106</entry>
<entry>10.21.41.0/24</entry>
</ipset>
ZONE
Simple Zone for Allowing Ports
<?xml version="1.0" encoding="utf-8"?>
<zone>
<source ipset="cljobshrpp-nodes"/>
<rule> <port port="60010" protocol="tcp"/> <accept/> </rule>
<rule> <port port="60011" protocol="tcp"/> <accept/> </rule>
</zone>
Zone for Allowing NFS
<?xml version="1.0" encoding="utf-8"?>
<zone>
<source ipset="xeadmin-nodes"/>
<short>xeadmin rules</short>
<rule>
<service name="nfs"/>
<accept/>
</rule>
<rule>
<service name="nfs3"/>
<accept/>
</rule>
</zone>